Name: Secure at the Speed of DevOps: Continuous Security with CloudBees Unify
Uploaded: 2025-10-23T10:16:03.734Z
Duration: 1 h 12 s
Description: Secure at the Speed of DevOps: Continuous Security with CloudBees Unify

Transcript for "Secure at the Speed of DevOps: Continuous Security with CloudBees Unify": Hi, everyone. Welcome to our webinar, Secure at the Speed of DevOps, Continuous Security with CloudVees Unify. I'm Liz Ryan, your senior product marketing manager here at CloudVees. And today, I'm joined by Mark Maxwell, our principal sales engineer. Hi, Mark. Hi. How are you, Liz? Doing well. Doing well. Good. Excited to talk about security with you. It's on everyone's mind. That's for sure. Yes. Absolutely. So we'll jump right in. Today's agenda, we'll discuss the realities and challenges of securing software today, which we're all very well aware of. And then we'll define and discuss continuous security as a concept across the software development life cycle, and we'll close it out with a demo on how to embed security in your CICD pipelines with a few steps in Cloud v c five. Right. So first, let's start by grounding ourselves in a little bit of a reality. Right? This is a known entity, security, but security incidents are escalating. 20% of breaches now stem from exploited vulnerabilities, nearly half involve ransomware, and it takes on average ninety four days to remediate leaked secrets on GitHub, one of the most popular developer platforms on the market today. Yeah. And those numbers, they they really highlight how long exposure window can be for an organization. Now if it takes three months to fix, a leaked secret, Log four j or others, attackers have plenty of time to exploit them. And then this just shows why automating detection or remediation right in the development workflow is just so critical for companies. Couldn't be more true. So speaking of that and that exposure period, the headlines speak for themselves. Right? We see these news stories all the time. They aren't fringe cases. They're happening everywhere, and they're happening to major organizations around the world. Yep. And it just shows anyone can be impacted by these vulnerabilities. You know, just last year, there were over 3,100 publicly dis disclosed data breaches, and and that's the ones that were actually disclosed. You know, and it's why it's so important to have a real time visibility for when those exposures are happening. It's before the breach, before the exploitation by a threat actor. Right. Because if they get it before, maybe it doesn't become such a public event and maybe they can prepare better for those incidents. Exactly. Yeah. So we've talked to dozens of platform secure and security leaders, and the pain is consistent across the board. Tools sprawl, inconsistent policies, alert fatigue, and manual audits are among many of their challenges that are dragging down their productivity and taking their attention. Yeah. And and and for developers, it's slow feedback loops, block releases. You know, these teams are they're they're drowning in tools, that that just don't talk to each other. It's wasting time chasing alerts just to try to reduce the risk that exists in the environment. So everyone's trying to move fast, but it's fragmented tooling that makes it really so painful. So it's looking at how do you streamline and unify policies, the tools, add in governance, you know, across the entire tool chain itself, this can really change the dynamic for, your your teams. Absolutely. And security leaders are under more pressure than ever. Right? We just went over a lot of their challenges. They're managing tool chaos, compliance audits, and now all of this AI generated code and all these automations that are coming from AI, and they don't know how to adjust. And this is where continuous security comes in. Continuous security is about embedding protection directly into every step in the software life cycle instead of bolting it on afterwards. Right. Absolutely. Continuous security really flips the old model on its head of waiting for after the fact of codes done in production. Now we're gonna look at remediation. Instead, you know, it's it's looking at how do you bake security into every stage of development. And that's how teams really you know, they can keep up to the speed of the monitor delivery, without sacrificing protection. Right. And if you're baking it into every step instead of being reactive about it, it's easier again to prepare for those incidents to proactively remediate them instead of having to scramble when there's an issue in production and all of your customers are yelling at you. Right? Yeah. Exactly. It's about security that works. It's really in the background, but it's not in the way. Developers need to stay focused on building. So security quietly needs to work behind the scenes, protecting every step, and only when it's necessary to get involved when those actions are needed to resolve those vulnerabilities or or exposures. Right. It's constant. It's automated. It's invisible. It's not in your face, and it's not a manual process for a developer. Like, we hear from a lot of developers today who have to manually run these security checks. Even if they're doing it in the earliest stages, they're still having to do that manual work. And continuous security should be about automating that process for them and really only flagging things when they're important. Yep. So, you know, security still it's too dependent upon the the developers, remembering in to add in the right tools, the right time, only run it with specific pipelines. And this this leaves gaps, especially across multiple scanners and tool chains because security may want to update things along the way, but it slows down and impacts the developer's time. You know, these security scans, they should happen implicitly. No new tools for the devs to learn, no steps for them to remember within their builds, let alone having to update hundreds, sometimes thousands of templates in their environments. You know, teams can get actionable contextual insights right in their flow, you know, automating the SBOMs, reducing the work, even collection of audit, artifacts necessary when, well, that audit time comes around. Absolutely. You know, continuous security should standardize security checks across the across the pipeline itself. You know, this goes back to having governance that's repeatable, consistent, and measurable. It's only then if you know if your teams are improving. You you get centralized policy as code, fewer false positives, and faster issue resolution all without breaking the bills. Yeah. And when I hear repeatable, consistent, and measurable, I think about predictability. Right? I I mean, you can't predict every attack that's gonna happen, but having some measure of predictability can just help you continue to be productive. Right? You're not waiting for the next shoe to drop, the next incident to happen. You actually have some guardrails in place to remediate those issues or the potential of them. Exactly. You know, and this just like you said, the to have information for the developers to actually and other teams, the members to see, you should be able to access it real time. Viewing where where the security posture is, you know, how how can you automate evidence collection and enable continuous compliance that is becoming more and more of a requirement for organizations that in the past, they weren't under such scrutiny for those compliance requirements. And then, you know, when evidence is collected and and and compliance is, is automated, you're always gonna be audit ready. And and this allows the teams themselves to focus on improve improving the security and head instead of spending days or weeks chasing paperwork around for an auditor. You shouldn't have to anticipate the end of quarter scramble or end of the year or end of month manually collecting audit information. Right. Right. I mean, I we've even talked to customers these today, this year, in 2025 that are still using spreadsheets. Right? Because they don't have any other way to do it. And that, to me, that sounds miserable. Right? Like, I would much rather be able to click a button and export my evidence and be able to use that rather than have to manually keep track of everything on a day to day basis. Right. And, you know, like you said, spreadsheet, screenshots, just the manual process itself, It takes time away from the developers doing what they're to do in the just hired to do in the first place, and that's build and deliver solutions to the customers. Right. Exactly. You know, and so all of this is really what Cloudbee's unified delivers. Think of it as a singular control pane across your build, test, deploy, and it plugs right into Jenkins, Tekton, GitHub, really whatever CI you use currently in your organization. You know, one place to enforce policy, see risk in real time, and and you're automating fixes across the pipeline. Now it's powerful because it doesn't force you to change how you work currently in your processes today. For the most part, you just stay intact. You know, when we speak to our customers, most want to consolidate their tools, but they see migration and the friction that it causes as a top pain point. Now, the AI driven automation gives full visibility. It controls access across the entire SDLC, all without the pain of migration or tool disruption so common when organizations are looking at consolidation in their tool chain. Yeah. You know, we did a survey recently with, a group of leaders around the whole migration pain point, and an overwhelming like, over 75% of them said that it was much more appealing to be able to consolidate the tools that they are already using into a control plane rather than having to rip and replace, shut down their teams, try to retrain their teams. You use you lose a lot of speed and agility if you do that. Right? And and you're not always guaranteed that you're gonna get the results that you're looking for by ripping and making everybody basically start start over again. Exactly. And a lot of organizations and customers, I've spoken with myself have been excited about where technology is going. Using AI to secure their code to improve their code throughput, reduce build times, but it's that friction when they're looking to migrate that makes it so hesitant. Or what they'll do is move forward with a a new tool or a a a new technology that's being embraced. But because that migration step is is so disruptive, it sits on the it sits on the shelf. Six months, maybe even a year goes by, and they haven't been able to begin that project because let's be honest. Time is one of the the things that you'll never have enough of. Those organizations themselves don't have dedicated project teams that just wait in the wind, on the sidelines looking to install new tools. No. It's your developers. It's your DevOps. It's your security folks that today already have a full week they're being asked to implement it. So really what one of the shining, opportunities with with Unify is its ability to fold into an organization with the tools they have and have minimal disruption with how their current flow is happening as well as the it'll it allows the teams themselves to keep using the tools that they're comfortable and familiar with. Yeah. And, you know, you you mentioned the CI agnostic nature of all this, but also for for this webinar specifically, security scanners. Like, we can integrate with any security scanner that a company is already using. We also have a set of security scanners that we have available if a company doesn't have any, you know, and wants to start using some through us. So that option's available and that flexibility is there for them from a security perspective too. Absolutely. Yeah. So, Mark, we've done a lot of talking. Right? A lot of telling. So why don't we do a little bit of showing? Let's let's take a look at how Unify makes continuous security a reality without slowing teams down in that whole rip and replace that we've been talking about. Alright. Before we go into the demo, I want to speak a little bit about of what we're gonna be looking at. And it's one of the key features of Unify, and that's implicit scanning. I know we mentioned it earlier, but this is truly the one of the key aspects of the always on security. This shifts enforcement out of code and into the security managed guardrails and governance that a lot of teams, especially your infosec teams, are are looking for. And your development teams are are look are also interested in wanting to implement this because it reduces developer burden while ensuring consistent, auditable controls in your SDLC. So I'll go ahead and share my screen out, and we'll go ahead and get started. When you log in to UNIFY, this is where it starts, in the components portion of the the solution. The components is is where we we add, your repos. So we're gonna start by just going over here to create component, and we're gonna look for a repo I have in my GitHub account and get it connected. You can see I'm gonna attach it to the hacker's organized org and create component. What this is gonna do is start a couple things so we can kind of look for it and see that it's been connected. And right away, we can see that it has some implicit implicit scans that are have been done, but then a new implicit scan because I've attached it onto this organization within Unify, and this is automatic. Again, it's removed from any requirements from your developers having to put it inside of a workflow. Now at the core of the implicit scan is, of course, your scanners. Here on the security place, page, we have the marketplace. And these are a list of the scanners that are included within Unify, and here you have the option to either turn on or off implicit scanning. Additionally, if you wanted to look for specific category, you can highlight those. Binary, you can look at code. So it simplifies if it's one that you're you're wanting to add or remove. Additionally, the ones that are included, you can, within your organization's toolset, add that to the marketplace via APIs, and then now it can be included as part of that implicit scan that's run, when anything is triggered within the repo itself. Again, it could be a, a merge. It could be a commit. Any event in that repo is gonna trigger the implicit scan. Additionally, here, you're able to add in SLAs around the vulnerabilities that are identified, very high as highs, mediums, and lows, and put this again as a governance in a guardrail, and none of this is involves the developers themselves. So if we go back to our repo that we added, we can see, well, the implicit scan is done. And let's take a look at the summary of this repo that we've added. So we can see, well, it's looked and identified vulnerabilities. 26 of them are in the high category. You can see the scanners that were identified and utilized. And, again, as you start to, run pipelines, workflows within the, the component. These will start to populate themselves over time. We can look at the runs, of course, the implicit scans. You can look at any workflows that are included within the repo, but then this is why we're here. This is the security aspect of it, and we're already connecting data and telemetry that's showing the vulnerabilities or the health of the repo. We can dig a little bit deeper and look at security center. And within security center, we can start to look at a more granular view of the vulnerabilities that were identified. And then from here, you can, look at applying specific filters, SLAs, severity, status, and, of course, tools. So we'll go ahead and look at Git Leaks tools specifically, and we can see within this one vulnerability, we can see the severity, the code, the category, finding. So this has been found in two different areas within the code, but then what it does is it normalizes and deduplicates. This is especially important if you have organizations or multiple tools that overlap with the same function. Obviously, you don't wanna have the same vulnerability show twice, but in that process of deduplicating and normalizing, it will only show itself once. And you could see that it first identified more than a week ago. From here, we can look at here's the two separate locations where it was located. You can look at additional details with the vulnerability, the branch it was located at. Again, a lot of the telemetry that they, is needed for triage and then ultimately the developer to resolve it. But oftentimes, we hear from our customers is, well, with our triage process, it's a spreadsheet, it's hours within a room, but you're able to do all of that here within Unify. You can look at the current status, severity, of course, things we mentioned already, in the in the demonstration. But then now you have the transition stays. What do you do next? Fixed required, false positive. This could be just because it's in a lower environment or it could be a risk accepted because it was purposely put in for some other purpose. You can then associate an expire date, and let's say we want it to, November 14. And then you're gonna put in a justification. So whoever is in charge of doing the triage may not be able to authorize this as risk accepted, but simply to put it in the category of it. So we'll put a justification here for simply just demo and triage the findings. And then you'll notice what happens next. This right here starts to populate. And this is waiting approval. And this is another level of governance that you can have within your triage process. So when we look at the vulnerability itself, we can see review. And it's looking for a higher level review and approval in order for this to be either approved and it's it doesn't need to be resolved until the November 14 time frame or whoever is looking at the same note. We need to do this. It's a specific feature for a release that we have within the next two weeks, so it needs to be resolved. Update the data, and these can be separated out by different roles based upon developer, who's in charge of triage, management, anyone within those groups and roles, basic RBAC, on the levels of authorization. And then from there, it's moved from unreviewed to awaiting approval to fix required. And then now it's waiting for the developer to fix this. You can tie this into either ServiceNow or Jira if that's where you're tracking most of your, vulnerabilities in the tickets. Something else I wanted to go ahead and show as far as what it is that you're able to see, and we're gonna look at a different repo for this one. This one's a little bit mature. It's had multiple runs in. But in the security summary, we can see it also includes the identification, the SBOM. This is the SBOM for the container itself. This is available to be exported in two different formats. One of which is CloneDX, but you also can do it in a simple PDF. Clone DX is the typical, and most requested format that's been asked for. So I hope this gave you an idea of exactly what implicit scanning is with with always on security and how you can take advantages of having a single location to review your vulnerabilities as you're identified, applying governance such as SLAs onto your vulnerabilities. And if you have any additional questions, please join us or take a look at cloudv's.com. Alright. Thanks for that demo, Mark. I wanted to close it out on some quotes that we've gotten from customers, and one here said that their enterprise security embedded scans helps them reduce costs and delays, and they fix issues in coding rather than after release, which we've talked about can be so costly for organizations. And, we're really seeing the benefits of these implicit scans already. So if you remember three things from this webinar, security doesn't have to slow you down. Right? And you can unify, not rip and replace. Right? We don't need to migrate necessarily. We can just bring it all together under a single control plane. And compliance can be continuous. Developers stay fast and CISOs stay confident. Yeah. CloudVis allows you to scale innovation and really minimize that migration friction without losing control, compromising security, you know, it it which is really so important. Absolutely. And CloudViz is already helping over 500,000 developers deliver 10 times faster while saving 21,000 engineering hours each year, all with stronger security and governance. You know, and that really puts it in perspective. It's not just about moving faster. It's about doing it safely and efficiently that that, organizations are so focused on. Right. It's doing it doing it the right way. Right? Right. So we hope you've enjoyed our discussion on making security continuous, contextual, and built to scale without slowing down innovation. Stay tuned for our next webinar where we'll highlight our new and innovative AI capabilities and our vision. Thank you. Thank you, Mark.